Common use of Business Associate Contract Clause in Contracts

Business Associate Contract. 1. The parties agree that the terms used, but not otherwise defined in the Common Terms and Definitions Paragraph of Exhibits B and C to the Agreement or in subparagraph B below, shall have the same meaning given to such terms under HIPAA, the HITECH Act, and their implementing regulations 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR performs, or delegates to subcontractors to perform, functions or activities on behalf of COUNTY pursuant to, and as set forth in, the Agreement that are described in the definition of 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of the Agreement, some of which may constitute PHI, as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in the 4. The parties intend to protect the privacy and provide for the security of PHI that may be created, received, maintained, transmitted, used, or disclosed pursuant to the Agreement in compliance with the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 12 A. GENERAL PROVISIONS AND RECITALS 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in Subparagraphs B.9 and B.14, apply to the CONTRACTOR in the same manner as they apply to a covered entity (COUNTY). CONTRACTOR agrees therefore to be in compliance at all times with the terms of this Business Associate Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the Security rules, as they may exist now or be hereafter amended, 34 35 36 37 EXHIBIT D X:\ASR\BEHAVIORAL HEALTH\ASR-14-000061 MENTAL HEALTH RESIDENTIAL REHABILITATION SERVICES MA 14-17 BU.DOCX «CONTRACT_CODE»- MAMHRR01MHKK17 1 with respect to PHI and electronic PHI created, received, maintained, transmitted, used, or disclosed 2 pursuant to the Agreement.

Business Associate Contract. 1. The parties agree that the terms used, but not otherwise defined in the Common Terms and Definitions Paragraph of Exhibits B Exhibit A, B, and C to the Agreement or in subparagraph B below, shall have the same meaning given to such terms under HIPAA, the HITECH Act, and their implementing regulationsimplementingregulations at 45 CFR Parts 160 and 164 HIPAA regulations as they may exist now or be hereafter 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR performs, or delegates to subcontractors to perform, functions or activities on behalf of COUNTY ofCOUNTY pursuant to, and as set forth in, the Agreement that are described in the definition of 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of the Agreement, some of which may constitute PHI, as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in the 4. The parties intend to protect the privacy and provide for the security of PHI that may be created, received, maintained, transmitted, used, or disclosed pursuant to the Agreement in compliance with the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 12 11 A. GENERAL PROVISIONS AND RECITALS 13 12 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in Subparagraphs B.9 and B.14, apply to the CONTRACTOR in the same manner as they apply to a covered entity (COUNTY). CONTRACTOR agrees therefore to be in compliance at all times with the terms of this Business Associate Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the Security rules, as they may exist now or be hereafter amended, 34 35 36 37 EXHIBIT D X:\ASR\BEHAVIORAL HEALTH\ASR-14-000061 MENTAL HEALTH RESIDENTIAL REHABILITATION SERVICES MA 14-17 BU.DOCX «CONTRACT_CODE»- MAMHRR01MHKK17 1 with respect to PHI and electronic PHI created, received, maintained, transmitted, used, or disclosed 2 pursuant to the Agreement.31 32

Business Associate Contract. 18 A. GENERAL PROVISIONS AND RECITALS 19 1. The parties partiesParties agree that the terms used, but not otherwise defined in the Common Terms 20 and Definitions Paragraph of Exhibits Exhibit AExhibits B and C to the Agreement or in subparagraph B 21 Subparagraphsubparagraph B. below, shall have the same meaning given to such terms under HIPAA, the 22 HITECH Act, and their implementing regulations at 23 45 CFR Parts 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 24 2. The parties partiesParties agree that a business associate relationship under HIPAA, the HITECH 25 Act, and the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 26 CONTRACTOR performs, or delegates to subcontractors to perform, functions or activities on behalf of 27 COUNTY pursuant to, and as set forth in, the Agreement that are described in the definition ofof “Business 28 Associate” in 45 CFR § 160.103. 29 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 30 terms of the Agreement, some of which may constitute PHI, as defined below in Subparagraph B.10, to 31 be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in thethe 32 Agreement. 33 4. The parties partiesParties intend to protect the privacy and provide for the security of PHI that may 34 be created, received, maintained, transmitted, used, or disclosed pursuant to the Agreement in compliance 35 with the applicable standards, implementation specifications, and requirements of HIPAA, the HITECHHITECH 36 Act, and the HIPAA regulations as they may exist now or be hereafter amended. 37 5. The parties partiesParties understand and acknowledge that HIPAA, the HITECH Act, and the 1 HIPAA regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-pre- 2 empted byby other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 12 A. GENERAL PROVISIONS AND RECITALS 13 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 3 6. The parties partiesParties understand that the HIPAA Privacy and Security rules, as defined below 4 in Subparagraphs B.9 and B.14, apply to the CONTRACTOR in the same manner as they apply to a thea 5 covered entity (COUNTY). CONTRACTOR agrees therefore to be in compliance at all times with the 6 terms of this Business Associate Contract and the applicable standards, implementation specifications, 7 and requirements of the Privacy and the Security rules, as they may exist now or be hereafter amended, 34 35 36 37 EXHIBIT D X:\ASR\BEHAVIORAL HEALTH\ASR-14-000061 MENTAL HEALTH RESIDENTIAL REHABILITATION SERVICES MA 14-17 BU.DOCX «CONTRACT_CODE»- MAMHRR01MHKK17 1 8 // 9 with respect to PHI and electronic PHI created, received, maintained, transmitted, used, or disclosed 2 10 pursuant to the Agreement. 11 B. DEFINITIONS 12 1. “Administrative Safeguards” are administrative actions, and policies and procedures, to 13 manage the selection, development, implementation, and maintenance of security measures to protect 14 electronic PHI and to manage the conduct of CONTRACTOR’s workforce in relation to the protection of 15 that information.

Business Associate Contract. 1. The parties agree that the terms used, but not otherwise defined in the Common Terms and Definitions Paragraph of Exhibits B Exhibit A, B, and C to the Agreement or in subparagraph B below, shall have the same meaning given to such terms under HIPAA, the HITECH Act, and their implementing regulationsimplementingregulations at 45 CFR Parts 160 and 164 HIPAA regulations as they may exist now or be hereafter 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR performs, or delegates to subcontractors to perform, functions or activities on behalf of COUNTY ofCOUNTY pursuant to, and as set forth in, the Agreement that are described in the definition of 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of the Agreement, some of which may constitute PHI, as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in the 4. The parties intend to protect the privacy and provide for the security of PHI that may be created, received, maintained, transmitted, used, or disclosed pursuant to the Agreement in compliance with the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 12 11 A. GENERAL PROVISIONS AND RECITALS 13 12 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in Subparagraphs B.9 and B.14, apply to the CONTRACTOR in the same manner as they apply to a the covered entity (COUNTY). CONTRACTOR agrees therefore to be in compliance at all times with the terms of this Business Associate Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the Security rules, as they may exist now or be hereafter amended, 34 35 36 37 EXHIBIT D X:\ASR\BEHAVIORAL HEALTH\ASR-14-000061 MENTAL HEALTH RESIDENTIAL REHABILITATION SERVICES MA 14-17 BU.DOCX «CONTRACT_CODE»- MAMHRR01MHKK17 1 with respect to PHI and electronic PHI created, received, maintained, transmitted, used, or disclosed 2 pursuant to the Agreement.

Business Associate Contract. A. GENERAL PROVISIONS AND RECITALS 20152016 30, 1515 1616 1717 1818 1919 2020 2121 222 2323 2424 2525 2626 2727 2828 2929 3030 3131 3232 333 3434 3535 3636 3737 1. The parties agree that the terms used, but not otherwise defined in the Common Terms and Definitions Paragraph of Exhibits B and C Exhibit A to the Agreement or in subparagraph B Subparagraph B. below, shall have the same meaning given to such terms under HIPAA, the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR performs, or delegates to subcontractors to perform, functions or activities on behalf of COUNTY pursuant to, and as set forth in, the Agreement that are described in the definition ofof “Business Associate” in 45 CFR § 160.103. 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of the Agreement, some of which w hichwhich may constitute PHI, as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in thethe Agreement. 4. The parties intend to protect the privacy and provide for the security of PHI that may be created, received, maintained, transmitted, used, or disclosed pursuant to the Agreement in compliance with the applicable standards, implementation specifications, and requirements of HIPAA, the HITECHHITECH Act, and the HIPAA regulations as they may exist now or be hereafter amended. 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 12 A. GENERAL PROVISIONS AND RECITALS 13 15 16 17 18 19 20 21 by other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. // // // 11 22 23 24 25 26 27 28 29 30 3133 44 55 66 77 88 99 1010 111 1212 1313 1414 1515 1616 1717 1818 1919 2020 2121 222 2323 2424 2525 2626 2727 2828 2929 3030 3131 3232 333 3434 3535 3636 3737 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in Subparagraphs B.9 and B.14, apply to the CONTRACTOR in the same manner as they apply to a the covered entity (COUNTY). CONTRACTOR agrees therefore to be in compliance at all times with the terms of this Business Associate Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the Security rules, as they may exist now or be hereafter amended, 34 35 36 37 EXHIBIT D X:\ASR\BEHAVIORAL HEALTH\ASR-14-000061 MENTAL HEALTH RESIDENTIAL REHABILITATION SERVICES MA 14-17 BU.DOCX «CONTRACT_CODE»- MAMHRR01MHKK17 1 with respect to PHI and electronic PHI ePHI created, received, maintained, transmitted, used, or disclosed 2 pursuant to the Agreement.